Integrated Compute Complex (ICC)

Certificate details

Certificate ID	#5558
Status	active
Validation dates	20.10.2026
Sunset date	19-10-2031
Standard	FIPS 140-3
Security level	1
Type	Firmware
Embodiment	SingleChip
Caveat	When operated in approved mode with module B227 True Random Number Generator (TRNG) Cryptographic Module validated to FIPS 140-3 under Cert. #5434 operating in approved mode. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.
Exceptions	Non-invasive security: N/A Mitigation of other attacks: N/A
Description	The Integrated Compute Complex (ICC) provides cryptography to subsystems within the Google IN763 SoC.
Vendor	Google, LLC http://www.google.com
Lab	Acumen Security
Algorithms	AES-CMACA7381 AES-ECBA7381 Conditioning Component Block Cipher Derivation Function SP800-90BA2932 Counter DRBGA7381 KDF SP800-108A7381 SHA2-256A7381
References	This certificate's webpage directly references 1 certificates, transitively this expands into 1 certificates.
Webpage
Security policy

Security policy PDF TXT
Extracted keywords

Symmetric Algorithms

AES-128, AES-256, AES-, AES, AES256, CAST, CMAC
Schemes

MAC
Randomness

TRNG, DRBG, RBG
Block cipher modes

CTR
Trusted Execution Environments

PSP
Security level

Level 1
Standards

FIPS 140-3, FIPS 180-4, SP 800-38B, SP 800-38A, SP 800-90B, SP 800-90A, SP 800-108, NIST SP 800-90B
Cross-references

Outgoing
5434 - active - B227 True Random Number Generator (TRNG) Cryptographic Module
Creation date	D:20261014125608-04'00'
Modification date	D:20261014125608-04'00'
Pages	30
Creator	Microsoft® Word for Microsoft 365
Producer	Microsoft® Word for Microsoft 365
Automated analysis

Automated inference - use with caution

All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.
No automatically derived data are available in this section.
Cross-references

Processing updates

26.10.2026

The certificate was first processed.
Raw data

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 5558,
  "dgst": "940a01e99ef8b507",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "#A2721",
        "SHA2-256A7381",
        "KDF SP800-108A7381",
        "Counter DRBGA7381",
        "#A2932",
        "#A7381",
        "AES-ECBA7381",
        "Conditioning Component Block Cipher Derivation Function SP800-90BA2932",
        "AES-CMACA7381"
      ]
    },
    "cpe_matches": null,
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "-"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": {
        "_type": "Set",
        "elements": [
          "5434"
        ]
      },
      "indirectly_referenced_by": null,
      "indirectly_referencing": {
        "_type": "Set",
        "elements": [
          "5434"
        ]
      }
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": [
        "5434"
      ]
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": {
        "_type": "Set",
        "elements": [
          "5434"
        ]
      },
      "indirectly_referenced_by": null,
      "indirectly_referencing": {
        "_type": "Set",
        "elements": [
          "5434"
        ]
      }
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": [
        "5434"
      ]
    },
    "related_cves": null,
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 0,
    "br1_tables": {
      "_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
      "approved_algorithms": {
        "entries": [
          {
            "algorithm": "AES-CMAC",
            "cavpCertName": "A7381",
            "properties": "Direction - Generation Key Length - 128, 192, 256 MAC Length - MAC Length: 128 Message Length - Message Length: 8- 1024 Increment 8",
            "reference": "SP 800-38B"
          },
          {
            "algorithm": "AES-ECB",
            "cavpCertName": "A2932",
            "properties": "Direction - Encrypt Key Length - 128, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-ECB",
            "cavpCertName": "A7381",
            "properties": "Direction - Encrypt Key Length - 128, 192, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "Conditioning Component Block Cipher Derivation Function SP800-90B",
            "cavpCertName": "A2932",
            "properties": "Key Length - 128 Payload Length - Payload Length: 512",
            "reference": "SP 800-90B"
          },
          {
            "algorithm": "Counter DRBG",
            "cavpCertName": "A2721",
            "properties": "Prediction Resistance - No, Yes Supports Reseed - Yes Mode - AES-128, AES-256 Derivation Function Enabled - No Additional Input - Additional Input: 0-256 Increment 8, Additional Input: 0-384 Increment 8 Entropy Input - Entropy Input: 256, Entropy Input: 384 Nonce - Nonce: 0 Personalization String Length - Personalization String Length: 0-256 Increment 8, Personalization String Length: 0-384 Increment 8 Returned Bits - 128, 512",
            "reference": "SP 800-90A Rev. 1"
          },
          {
            "algorithm": "Counter DRBG",
            "cavpCertName": "A7381",
            "properties": "Prediction Resistance - No Supports Reseed - No Mode - AES-256 Derivation Function Enabled - No Additional Input - Additional Input: 0-256 Increment 8 Entropy Input - Entropy Input: 384 Nonce - Nonce: 0 Personalization String Length - Personalization String Length: 0-256 Increment 8 Returned Bits - 512",
            "reference": "SP 800-90A Rev. 1"
          },
          {
            "algorithm": "KDF SP800-108",
            "cavpCertName": "A7381",
            "properties": "KDF Mode - Counter MAC Mode - CMAC-AES256 Supported Lengths - Supported Lengths: 128, 256 Fixed Data Order - Before Fixed Data Counter Length - 32 Supports Empty IV - No Custom Key In Length - 0",
            "reference": "SP 800-108 Rev. 1"
          },
          {
            "algorithm": "SHA2-256",
            "cavpCertName": "A7381",
            "properties": "Message Length - Message Length: 0- 16384 Increment 8",
            "reference": "FIPS 180-4"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "approved_services": {
        "entries": [
          {
            "description": "Module and PSP functions including generate PSP Master Key",
            "indicator": "Approve d mode indicator (\"Notice: GSP: crypto self-test passed\" and \"Notice: PSP: activatin g\" logs) combine d with successf ul completi on of the service",
            "inputs": "N/A",
            "name": "Initialize",
            "outputs": "Status (success/fail ure of self- tests)",
            "rolesSspAccess": "CO - Master PSP Keys: W",
            "secFunImpl": "Key Derivatio n"
          },
          {
            "description": "Executed automatic ally when powered on",
            "indicator": "Approve d mode indicator (\"Notice: GSP: crypto self-test passed\" and \"Notice: PSP: activatin g\" logs) combine d with successf ul completi",
            "inputs": "Reset",
            "name": "Perform self-tests",
            "outputs": "Status (success/fail ure of self- tests)",
            "rolesSspAccess": "CO",
            "secFunImpl": "None"
          },
          {
            "description": "",
            "indicator": "on of the service",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "",
            "secFunImpl": ""
          },
          {
            "description": "Status retrieved from the module",
            "indicator": "Approve d mode indicator (\"Notice: GSP: crypto self-test passed\" and \"Notice: PSP: activatin g\" logs) combine d with successf ul completi on of the service",
            "inputs": "N/A",
            "name": "Show status",
            "outputs": "Status (Approved mode indicator/err or indicator)",
            "rolesSspAccess": "CO",
            "secFunImpl": "None"
          },
          {
            "description": "A module reset zeroises all SSPs",
            "indicator": "Approve d mode indicator (\"Notice: GSP: crypto self-test passed\" and \"Notice: PSP: activatin g\" logs) combine d with successf ul completi on of the service",
            "inputs": "Reset",
            "name": "Zeroizatio n",
            "outputs": "N/A",
            "rolesSspAccess": "CO - Entropy Input String: Z - DRBG Seed: Z - DRBG V : Z - DRBG Key: Z - Master PSP Keys: Z - Security Associati on Databas e (SADB) Protectio n keys: Z - PSP",
            "secFunImpl": "None"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Session Keys: Z",
            "secFunImpl": ""
          },
          {
            "description": "CPU managem ent instruction (start CPU)",
            "indicator": "Approve d mode indicator (\"Notice: GSP: crypto self-test passed\" and \"Notice: PSP: activatin g\" logs) combine d with successf ul completi on of the service",
            "inputs": "start CPU",
            "name": "CPU state managem ent",
            "outputs": "CPU state",
            "rolesSspAccess": "CO",
            "secFunImpl": "None"
          },
          {
            "description": "Print buffer, command buffer",
            "indicator": "Approve d mode indicator (\"Notice: GSP: crypto self-test passed\" and \"Notice: PSP: activatin g\" logs) combine d with successf ul completi on of the service",
            "inputs": "Get command",
            "name": "Get informatio n (Show Version / Show module\u0027s versioning informatio n)",
            "outputs": "Module\u0027s firmware version (2.10.0), module identifier (\"imc\")",
            "rolesSspAccess": "CO",
            "secFunImpl": "None"
          },
          {
            "description": "Start, stop functions",
            "indicator": "Approve d mode indicator",
            "inputs": "Start/stop functions/comma nds",
            "name": "Print buffer",
            "outputs": "N/A",
            "rolesSspAccess": "CO",
            "secFunImpl": "None"
          },
          {
            "description": "",
            "indicator": "(\"Notice: GSP: crypto self-test passed\" and \"Notice: PSP: activatin g\" logs) combine d with successf ul completi on of the service",
            "inputs": "",
            "name": "managem ent",
            "outputs": "",
            "rolesSspAccess": "",
            "secFunImpl": ""
          },
          {
            "description": "Input of request data",
            "indicator": "Approve d mode indicator (\"Notice: GSP: crypto self-test passed\" and \"Notice: PSP: activatin g\" logs) combine d with successf ul completi on of the service",
            "inputs": "Request data",
            "name": "Submit request data",
            "outputs": "N/A",
            "rolesSspAccess": "CO",
            "secFunImpl": "None"
          },
          {
            "description": "Retrieval of response data",
            "indicator": "Approve d mode indicator (\"Notice: GSP: crypto self-test passed\"",
            "inputs": "N/A",
            "name": "Retrieve response data",
            "outputs": "Response data",
            "rolesSspAccess": "CO",
            "secFunImpl": "None"
          },
          {
            "description": "",
            "indicator": "and \"Notice: PSP: activatin g\" logs) combine d with successf ul completi on of the service",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "",
            "secFunImpl": ""
          },
          {
            "description": "To generate a new PSP Master Key (Post- initializatio n) a.k.a. \"Rotate key generation \"",
            "indicator": "Approve d mode indicator (\"Notice: GSP: crypto self-test passed\" and \"Notice: PSP: activatin g\" logs) combine d with successf ul completi on of the service",
            "inputs": "Key rotation/new key generation request via module API",
            "name": "Generate New PSP Master Key",
            "outputs": "Newly generated key",
            "rolesSspAccess": "CO - Master PSP Keys: W - Entropy Input String: W,E - DRBG Seed: G,E - DRBG V : G,E - DRBG Key: G,E",
            "secFunImpl": "Random Number Generati on"
          },
          {
            "description": "To derive PSP Session Keys",
            "indicator": "Approve d mode indicator (\"Notice: GSP: crypto self-test passed\" and \"Notice: PSP: activatin g\" logs)",
            "inputs": "Master PSP Key",
            "name": "Derive PSP Keys",
            "outputs": "PSP Session Key",
            "rolesSspAccess": "CO - PSP Session Keys: G - Master PSP Keys: G,E",
            "secFunImpl": "Key Derivatio n"
          },
          {
            "description": "",
            "indicator": "combine d with successf ul completi on of the service",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "",
            "secFunImpl": ""
          },
          {
            "description": "Random bit generation",
            "indicator": "Approve d mode indicator (\"Notice: GSP: crypto self-test passed\" and \"Notice: PSP: activatin g\" logs) combine d with successf ul completi on of the service",
            "inputs": "Request for random bits",
            "name": "Generate DRBG output",
            "outputs": "Random bits generated",
            "rolesSspAccess": "CO - DRBG Seed: G,E - DRBG Key: G,E - DRBG V : G,E - Entropy Input String: R,E",
            "secFunImpl": "Random Number Generati on Entropy Source"
          },
          {
            "description": "Firmware load/integr ity test performed by the ICC module for the LCE module",
            "indicator": "Approve d mode indicator (\"Notice: GSP: crypto self-test passed\" and \"Notice: PSP: activatin g\" logs) combine d with successf ul completi",
            "inputs": "N/A",
            "name": "Perform Firmware Load Test (LCE)",
            "outputs": "Status (success/fail ure of the self-test)",
            "rolesSspAccess": "CO",
            "secFunImpl": "FW Integrity Check"
          },
          {
            "description": "",
            "indicator": "on of the service",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "",
            "secFunImpl": ""
          },
          {
            "description": "Used to encrypt SADB and PSP traffic",
            "indicator": "Approve d mode indicator (\"Notice: GSP: crypto self-test passed\" and \"Notice: PSP: activatin g\" logs) combine d with successf ul completi on of the",
            "inputs": "Plaintext",
            "name": "Encryption",
            "outputs": "Ciphertext",
            "rolesSspAccess": "CO - Security Associati on Databas e (SADB) Protectio n keys: E - PSP Session Keys: E",
            "secFunImpl": "Encrypti on"
          },
          {
            "description": "Used to generate a hash of the input provided",
            "indicator": "service Approve d mode indicator (\"Notice: GSP: crypto self-test passed\" and \"Notice: PSP: activatin g\" logs) combine d with successf ul completi on of the service",
            "inputs": "Plaintext message",
            "name": "Hashing",
            "outputs": "Hash",
            "rolesSspAccess": "CO",
            "secFunImpl": "Hashing"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 3
      },
      "authentication_methods": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 1
      },
      "cond_self_tests": {
        "entries": [
          {
            "algorithmOrTest": "AES-ECB (A7381) - 128 bits",
            "condition": "On boot",
            "details": "Encrypt",
            "indicator": "\"Notice: GSP: crypto self-test passed\"",
            "testMethod": "KAT",
            "testProps": "Key Length: 128 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-ECB (A7381) - 192 bits",
            "condition": "On boot",
            "details": "Encrypt",
            "indicator": "\"Notice: GSP: crypto self-test passed\"",
            "testMethod": "KAT",
            "testProps": "Key Length: 192 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-ECB (A7381) - 256 bits",
            "condition": "On boot",
            "details": "Encrypt",
            "indicator": "\"Notice: GSP: crypto self-test passed\"",
            "testMethod": "KAT",
            "testProps": "Key Length: 256 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-CMAC (A7381)",
            "condition": "On boot",
            "details": "Generation",
            "indicator": "\"Notice: GSP: crypto self-test passed\"",
            "testMethod": "KAT",
            "testProps": "Key Length: 128 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2-256 (A7381)",
            "condition": "On boot",
            "details": "Hash",
            "indicator": "\"Notice: GSP: crypto self-test passed\"",
            "testMethod": "KAT",
            "testProps": "256 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Counter DRBG (A7381)",
            "condition": "On boot",
            "details": "Generate, Reseed, Instantiate functions",
            "indicator": "\"Notice: GSP: crypto self-test passed\"",
            "testMethod": "KAT",
            "testProps": "AES CTR (256 bits)",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Counter DRBG (A2721)",
            "condition": "On boot",
            "details": "Generate, Reseed, Instantiate functions",
            "indicator": "\"Notice: GSP: crypto self-test passed\"",
            "testMethod": "KAT",
            "testProps": "AES CTR (256 bits)",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "LCE Firmware Integrity/Load Test (AES- CMAC 256- bit)",
            "condition": "On boot",
            "details": "MAC generation",
            "indicator": "\"Notice: GSP: crypto self-test passed\"",
            "testMethod": "Firmware Integrity/Load Test for the LCE module",
            "testProps": "Key Length: 256 bits",
            "type": "SW/FW Load"
          },
          {
            "algorithmOrTest": "B227 Adaptive Proportion Test (ESV Cert. E137)",
            "condition": "On boot",
            "details": "[EVM]",
            "indicator": "\"Notice: GSP: crypto self-test passed\"",
            "testMethod": "SP 800-90B Health Tests",
            "testProps": "Sample size: 1 bit; Min- Entropy: H=50%; Cutoff Value: C=793; Window size: w=1024; False positive error rate: Alpha = 2^- 20",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "B227 Repetition Count Test (ESV Cert. E137)",
            "condition": "On boot",
            "details": "[EVM]",
            "indicator": "\"Notice: GSP: crypto self-test passed\"",
            "testMethod": "SP 800-90B Health Tests",
            "testProps": "Sample size: 1 bit; Min- Entropy: H=50%; Cutoff Value: C=41; False positive error rate: Alpha = 2^- 20",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KDF SP800- 108 (A7381)",
            "condition": "On boot",
            "details": "Counter Mode",
            "indicator": "\"Notice: GSP: crypto self-test passed\"",
            "testMethod": "KAT",
            "testProps": "Mode: Counter, PRF: CMAC- AES256",
            "type": "CAST"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 2
      },
      "error_states": {
        "entries": [
          {
            "conditions": "Failure of the LCE Firmware Integrity Test / Firmware Load Test",
            "description": "Upon failure of the LCE Firmware Integrity Test / Firmware Load Test",
            "indicator": "ERROR: Firmware hash for image 99 DOES NOT MATCH, ERROR: lce abort image load",
            "name": "Soft Error state",
            "recoveryMethod": "The module will return an error indicator and resume operation"
          },
          {
            "conditions": "Failure of the pre-operational firmware integrity test Failure of the CASTs",
            "description": "No cryptographic functions can be executed and all data output is inhibited",
            "indicator": "\"Integrity FAIL\" for the failure of the pre-operational firmware integrity test and \"crypto self-test failed\" for the failure of one/more CASTs",
            "name": "Hard Error state",
            "recoveryMethod": "The module would have to be re- initialized via a reload/reboot"
          },
          {
            "conditions": "Failure of a NIST SP 800- 90B Health Test",
            "description": "[EVM] The Soft Error state is cleared automatically by the B227 entropy source (the source raises an alarm, zeroises itself and becomes operational again)",
            "indicator": "Failure of a NIST SP 800-90B Health Test causes the entropy source to raise an alarm and zeroise itself",
            "name": "B227 Soft Error state",
            "recoveryMethod": "The entropy source (and thus the bound B227 module as a whole) recovers automatically"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 4
      },
      "mechanisms_actions": {
        "entries": [
          {
            "inspectFreq": "None",
            "inspectGuidance": "None",
            "mechanism": "Standard passivation applied on the IN763 SoC"
          }
        ],
        "found": true,
        "section": 7,
        "subsection": 1
      },
      "modes_of_operation": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 4
      },
      "non_approved_allowed_NSC": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_allowed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_not_allowed": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_services": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 4
      },
      "ports_interfaces": {
        "entries": [
          {
            "data": "Secure EL1 command parameters; Fast Secure Monitor API parameters ; Google service request API parameters",
            "logicalInterface": "Data Input",
            "physicalPort": "N/A"
          },
          {
            "data": "Secure EL1 return data ; Fast Secure Monitor API return data; Google service request API return data",
            "logicalInterface": "Data Output",
            "physicalPort": "N/A"
          },
          {
            "data": "Secure EL1 commands; Fast Secure Monitor API commands; Google service request API commands, reset signal",
            "logicalInterface": "Control Input",
            "physicalPort": "N/A"
          },
          {
            "data": "Secure EL1 command response codes; Fast Secure Monitor API response codes; Google service request API response codes",
            "logicalInterface": "Status Output",
            "physicalPort": "N/A"
          },
          {
            "data": "Provides power to the module",
            "logicalInterface": "Power",
            "physicalPort": "N/A"
          }
        ],
        "found": true,
        "section": 3,
        "subsection": 1
      },
      "roles": {
        "entries": [
          {
            "authMethodList": "None",
            "name": "CO",
            "operatorType": "Crypto Officer",
            "type": "Role"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 2
      },
      "security_levels": {
        "entries": [
          {
            "level": "1",
            "section": "1",
            "title": "General"
          },
          {
            "level": "1",
            "section": "2",
            "title": "Cryptographic module specification"
          },
          {
            "level": "1",
            "section": "3",
            "title": "Cryptographic module interfaces"
          },
          {
            "level": "1",
            "section": "4",
            "title": "Roles, services, and authentication"
          },
          {
            "level": "1",
            "section": "5",
            "title": "Software/Firmware security"
          },
          {
            "level": "1",
            "section": "6",
            "title": "Operational environment"
          },
          {
            "level": "1",
            "section": "7",
            "title": "Physical security"
          },
          {
            "level": "N/A",
            "section": "8",
            "title": "Non-invasive security"
          },
          {
            "level": "1",
            "section": "9",
            "title": "Sensitive security parameter management"
          },
          {
            "level": "1",
            "section": "10",
            "title": "Self-tests"
          },
          {
            "level": "1",
            "section": "11",
            "title": "Life-cycle assurance"
          },
          {
            "level": "N/A",
            "section": "12",
            "title": "Mitigation of other attacks"
          },
          {
            "level": "1",
            "section": "",
            "title": "Overall Level"
          }
        ],
        "found": true,
        "section": 1,
        "subsection": 2
      },
      "self_tests": {
        "entries": [
          {
            "algorithmOrTest": "AES-CMAC Verification",
            "details": "MAC Verify",
            "indicator": "\"Notice: GSP: crypto self-test passed\"",
            "testMethod": "KAT",
            "testProps": "256 bits",
            "type": "SW/FW Integrity"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 1
      },
      "ssp_io_methods": {
        "entries": [
          {
            "dest": "LSM",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Entropy Input",
            "sfiAlgo": "",
            "source": "B227 TRNG"
          },
          {
            "dest": "External entity",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Output - 1",
            "sfiAlgo": "",
            "source": "LSM"
          },
          {
            "dest": "External entity",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Output - 2",
            "sfiAlgo": "",
            "source": "Random Number Generator"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 2
      },
      "ssp_zeroization_methods": {
        "entries": [
          {
            "description": "SSPs stored ephemerally are zeroised on resetting the module",
            "method": "Zeroised on reset",
            "operatorId": "Operator Initiated",
            "rationale": "SSPs stored ephemerally are zeroised on resetting the module"
          },
          {
            "description": "Automatic zeroisation per the module design",
            "method": "Zeroised after writing to the calling application/subsystem",
            "operatorId": "Module Initiated",
            "rationale": "Temporarily stored SSPs are zeroised once no longer used"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 3
      },
      "storage_areas": {
        "entries": [
          {
            "description": "Ephemeral storage of SSPs in plaintext",
            "name": "LSM",
            "persistance": "Dynamic"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 1
      },
      "tested_module_id_hw": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_hw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_sw_fw_hy": {
        "entries": [
          {
            "features": "N/A",
            "integrityTest": "AES-CMAC Verification",
            "packageFileName": "ICC Secure Firmware",
            "swFwVersion": "2.10.0"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      },
      "tested_op_env_sw_fw_hy": {
        "entries": [
          {
            "hardwarePlatform": "IN763 SoC A0",
            "hypervisorHostOs": "N/A",
            "operatingSystem": "N/A",
            "paa_pai": "No",
            "processors": "ARM Cortex-A53 (ARMv8)",
            "version": "2.10.0"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      },
      "vendor_affirmed_algos": {
        "entries": [
          {
            "algoPropList": "Key Type:Symmetric",
            "implName": "N/A",
            "name": "CKG - Section 4",
            "reference": "NIST SP 800-133r2 Section 4 option 1 Using the Output of a Random Bit Generator; NIST SP 800-133r2 Section 6.1 The \"Direct Generation\" of Symmetric Keys; NIST SP 800-133r2 Section 6.2.2 Symmetric Keys Derived from a Pre-existing Key"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "vendor_affirmed_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      }
    },
    "is_br1_format": true,
    "keywords": {
      "asymmetric_crypto": {},
      "certification_process": {},
      "cipher_mode": {
        "CTR": {
          "CTR": 2
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {},
      "crypto_protocol": {},
      "crypto_scheme": {
        "MAC": {
          "MAC": 6
        }
      },
      "device_model": {},
      "ecc_curve": {},
      "eval_facility": {},
      "fips_cert_id": {
        "Cert": {
          "#2": 1,
          "#5434": 1,
          "Cert. 5434": 1
        }
      },
      "fips_certlike": {
        "Certlike": {
          "AES CTR (256": 2,
          "AES- 128": 2,
          "AES-128": 4,
          "AES-256": 7,
          "AES-CMAC (256": 1,
          "AES256": 1,
          "SHA2-256": 3
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 1": 4
        }
      },
      "hash_function": {},
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {},
      "randomness": {
        "PRNG": {
          "DRBG": 40
        },
        "RNG": {
          "RBG": 2
        },
        "TRNG": {
          "TRNG": 4
        }
      },
      "side_channel_analysis": {},
      "standard_id": {
        "FIPS": {
          "FIPS 140-3": 9,
          "FIPS 180-4": 1
        },
        "NIST": {
          "NIST SP 800-90B": 3,
          "SP 800-108": 2,
          "SP 800-38A": 2,
          "SP 800-38B": 1,
          "SP 800-90A": 2,
          "SP 800-90B": 5
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 2,
            "AES-": 4,
            "AES-128": 4,
            "AES-256": 7,
            "AES256": 1
          },
          "CAST": {
            "CAST": 20
          }
        },
        "constructions": {
          "MAC": {
            "CMAC": 2
          }
        }
      },
      "tee_name": {
        "AMD": {
          "PSP": 28
        }
      },
      "tls_cipher_suite": {},
      "vendor": {},
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "SHA2-256A7381",
        "KDF SP800-108A7381",
        "Counter DRBGA7381",
        "AES-ECBA7381",
        "Conditioning Component Block Cipher Derivation Function SP800-90BA2932",
        "AES-CMACA7381"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A2721",
        "#A2932",
        "#A7381"
      ]
    },
    "policy_metadata": {
      "/CreationDate": "D:20261014125608-04\u002700\u0027",
      "/Creator": "Microsoft\u00ae Word for Microsoft 365",
      "/ModDate": "D:20261014125608-04\u002700\u0027",
      "/Producer": "Microsoft\u00ae Word for Microsoft 365",
      "pdf_file_size_bytes": 461603,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": [
          "http://csrc.nist.gov/groups/STM/cmvp/index.html"
        ]
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 30
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "9b3ba845a96e970ab70bb5d0c36ad8c28238b9cbcf4253bd0d5d66abc948d15b",
      "source_hash": "8d3af186028914d43e9c2534d3bba74e514337d299fdd831da47cb5bc6217ebb",
      "txt_hash": "35e4bd0cb246cd0d1ba29e8edd6eb422efe111027b1af048a42605778fceeba6"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "When operated in approved mode with module B227 True Random Number Generator (TRNG) Cryptographic Module validated to FIPS 140-3 under Cert. #5434 operating in approved mode. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.",
    "certificate_pdf_url": null,
    "date_sunset": "2031-10-19",
    "description": "The Integrated Compute Complex (ICC) provides cryptography to subsystems within the Google IN763 SoC.",
    "embodiment": "SingleChip",
    "exceptions": [
      "Non-invasive security: N/A",
      "Mitigation of other attacks: N/A"
    ],
    "fw_versions": null,
    "historical_reason": null,
    "hw_versions": null,
    "level": 1,
    "mentioned_certs": {
      "5434": 1
    },
    "module_name": "Integrated Compute Complex (ICC)",
    "module_type": "Firmware",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "active",
    "sw_versions": null,
    "tested_conf": null,
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2026-10-20",
        "lab": "Acumen Security",
        "validation_type": "Initial"
      }
    ],
    "vendor": "Google, LLC",
    "vendor_url": "http://www.google.com"
  }
}
Sections

Integrated Compute Complex (ICC)

Certificate details

Security policy

Extracted keywords

Symmetric Algorithms

Schemes

Randomness

Block cipher modes

Trusted Execution Environments

Security level

Standards

Cross-references

File metadata

Automated analysis

Automated inference - use with caution

Cross-references

Processing updates

New certificate

Raw data

Sections

Integrated Compute Complex (ICC)

Certificate details

Security policy

Extracted keywords

Cryptography

Symmetric Algorithms

Schemes

Randomness

Block cipher modes

Device

Trusted Execution Environments

Security

Security level

Other

Standards

Cross-references

File metadata

Automated analysis

Automated inference - use with caution

Cross-references

Processing updates

Raw data

Toggle raw data
